linux-kernel - Re: [PATCH] hwmon: drivetemp: Fix driver producing garbage data when SCSI errors occur

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2d5cc90c-89a2-4af3-a3f8-2c5487d571e7@roeck-us.net>
Date: Sun, 5 Jan 2025 14:37:16 -0800
From: Guenter Roeck <linux@...ck-us.net>
To: Daniil Stas <daniil.stas@...teo.net>, linux-hwmon@...r.kernel.org
Cc: Chris Healy <cphealy@...il.com>, Linus Walleij
 <linus.walleij@...aro.org>, "Martin K. Petersen"
 <martin.petersen@...cle.com>, Bart Van Assche <bvanassche@....org>,
 linux-kernel@...r.kernel.org, linux-scsi@...r.kernel.org,
 linux-ide@...r.kernel.org
Subject: Re: [PATCH] hwmon: drivetemp: Fix driver producing garbage data when
 SCSI errors occur

On 1/5/25 13:36, Daniil Stas wrote:
> scsi_execute_cmd() function can return both negative (linux codes) and
> positive (scsi_cmnd result field) error codes.
> 
> Currently the driver just passes error codes of scsi_execute_cmd() to
> hwmon core, which is incorrect because hwmon only checks for negative
> error codes. This leads to hwmon reporting uninitialized data to
> userspace in case of SCSI errors (for example if the disk drive was
> disconnected).
> 
> This patch checks scsi_execute_cmd() output and returns -EIO if it's
> error code is positive.
> 
> Signed-off-by: Daniil Stas <daniil.stas@...teo.net>
> Cc: Guenter Roeck <linux@...ck-us.net>
> Cc: Chris Healy <cphealy@...il.com>
> Cc: Linus Walleij <linus.walleij@...aro.org>
> Cc: Martin K. Petersen <martin.petersen@...cle.com>
> Cc: Bart Van Assche <bvanassche@....org>
> Cc: linux-kernel@...r.kernel.org
> Cc: linux-scsi@...r.kernel.org
> Cc: linux-ide@...r.kernel.org
> Cc: linux-hwmon@...r.kernel.org
> ---
> 
> Although I see there is scsi_status_is_good() function, which probably
> means that not all scsi result codes are errors? I don't know scsi
> protocol much, so maybe someone else can check it.
> The error code that i see when the drive is physically disconnected: 0x00030000.
> 

Unless I am missing something, scsi_status_is_good() returns true for
0x00030000, so using that would miss this and various other errors.
As far as I can see from the code, any non-zero host byte indicates
an error, and the host byte is independent of the status (in the lower
16 bit).

Guenter

>   drivers/hwmon/drivetemp.c | 7 +++++--
>   1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/hwmon/drivetemp.c b/drivers/hwmon/drivetemp.c
> index 6bdd21aa005a..fdf1d3b3b5a5 100644
> --- a/drivers/hwmon/drivetemp.c
> +++ b/drivers/hwmon/drivetemp.c
> @@ -192,8 +192,11 @@ static int drivetemp_scsi_command(struct drivetemp_data *st,
>   	scsi_cmd[12] = lba_high;
>   	scsi_cmd[14] = ata_command;
>   
> -	return scsi_execute_cmd(st->sdev, scsi_cmd, op, st->smartdata,
> -				ATA_SECT_SIZE, HZ, 5, NULL);
> +	int err = scsi_execute_cmd(st->sdev, scsi_cmd, op, st->smartdata,
> +				   ATA_SECT_SIZE, HZ, 5, NULL);
> +	if (err > 0)
> +		err = -EIO;
> +	return err;
>   }
>   
>   static int drivetemp_ata_command(struct drivetemp_data *st, u8 feature,